Claim tenant did not pass validation in multitenancy

 def call(conn, opts) do
   ...
      {tenant, x_tenant} =
        if check_explicit_no_tenant(conn), do: {nil, "none"}, else: {site.id, site.id}

      conn
      |> Ash.PlugHelpers.set_tenant(tenant)
      |> put_resp_header("x-tenant-id", x_tenant)
      |> assign(:current_site, site)
end

[debug] Claim %{"tenant" => "699debb0-9606-44d3-b824-c6763405cc34"} did not pass validation.
Current time: 1755167657
[debug] forbidden: Forbidden | forbidden

read :sign_in_with_password do
    description "Attempt to sign in using a email and password."
    get? true

    ...

    prepare fn query, _context ->
    query = Ash.Query.set_context(query, %{private: %{ash_authentication?: true}})
    current_tenant = query.tenant

    query =
        if current_tenant,
        do: Ash.Query.filter(query, site_id == ^current_tenant),
        else: Ash.Query.filter(query, is_nil(site_id))

    query |> Ash.Query.load(:site)
    # To make sure all tokens is from none tenant
    Ash.Query.set_tenant(query, nil)
    end

    # validates the provided email and password and generates a token
    prepare AshAuthentication.Strategy.Password.SignInPreparation

  ...
end

{
  ...
  "purpose": "user",
  "tenant": null
}

{
  ...
  "purpose": "user",
  "tenant": id..
}